System and method for provisioning and authenticating via a network

A system for communicating via a network, the system comprising:

• means for providing a communication link between a peer and a server;
• means for determining whether a shared secret exists between the peer and the server;
• means for provisioning a shared secret between the peer and the server responsive to the means for determining whether the shared secret exists determining the shared secret does not exist, wherein the means for provisioning comprises means for establishing a first secure tunnel between the peer and server using asymmetric encryption, means for acquiring the shared secret through the first secure tunnel, and means for tearing down the first secure tunnel after the means for acquiring has acquired the shared secret;
• means for establishing a subsequent new secure tunnel utilizing, in conjunction with a secure tunnel protocol, the shared secret after the means for tearing down has torn down the first secure tunnel and responsive to the means for determining whether a shared secret exists determining that the shared secret exists, wherein the means for establishing the subsequent new secure tunnel comprises means for deriving a tunnel key using symmetric cryptography based on the shared secret;
• means for authenticating a relationship between the peer and the server within the subsequent new secure tunnel;
• means for establishing an inner authentication protocol;
• and
• means for cryptographically binding the inner authentication protocol with the secure tunnel protocol in accordance with binding of keying material associated with the secure tunnel and keying material associated with content communicated in the secure tunnel.

A wireless device, comprising:

• a wireless network adapter for sending and receiving wireless signals with a server;
• wherein the wireless device is configured to determine whether a shared secret exists between the wireless device and the server;
• wherein the wireless device is configured to receive a shared secret from the server upon determining that a shared secret does not exist with the server, by establishing a first secure tunnel with server using asymmetric encryption, receiving the shared secret via the first secure tunnel from the server, and tearing down the first secure tunnel after receiving the shared secret;
• wherein the wireless device is configured to establish a subsequent new secure tunnel, using a secure tunnel protocol, between the wireless device and the server after the first secure tunnel has been torn down and upon determining the shared secret exists by using the shared secret to mutually derive a tunnel key using symmetric cryptography based on the shared secret;
• wherein the wireless device is configured to mutually authenticate with the server employing the subsequent new secure tunnel;
• wherein the wireless device is configured to establish an inner authentication protocol;
• and
• wherein the wireless device is configured to cryptographically bind the inner authentication protocol with the secure tunnel protocol in accordance with binding of keying material associated with the secure tunnel and keying material associated with content communicated in the secure tunnel.

A method, comprising:

• determining whether a shared secret exists between a peer and a server;
• establishing a first secure tunnel between the peer and the server using asymmetric encryption responsive to determining the shared secret does not exist between the peer and the server;
• provision the shared secret to the peer via the first secure tunnel between the peer and the server responsive to the determining that the shared secret does not exist between the peer and the server and to the establishing the first secure tunnel, the shared secret comprises a protected access credential opaque element, the protected access credential opaque element comprises an identity;
• tearing down the first secure tunnel;
• establishing a subsequent new secure tunnel between the peer and the server using a secure tunnel protocol comprised of a symmetric encryption and the shared secret after the tearing down the first secure tunnel and after the peer has received the shared secret, wherein establishing the subsequent new secure tunnel comprises receiving the protected access credential opaque element from the peer;
• mutually deriving a tunnel key for the subsequent new secure tunnel using symmetric cryptography based on the shared secret responsive to establishing the subsequent new secure tunnel;
• authenticating a relationship between the peer and the server within the subsequent new secure tunnel upon mutually deriving the tunnel key for the subsequent new secure tunnel, the authenticating a relationship comprises receiving an identity from the peer;
• establishing an inner authentication protocol;
• cryptographically binding the inner protocol with the secure tunnel protocol in accordance with binding of keying material associated with the secure tunnel and keying material associated with content communicated in the secure tunnel;
• and
• verifying the identity received from the peer matches the identity in the protected access credential opaque element.